ABSTRACT THE STATE-OF-THE-ART FOR HSI IN SHIPBUILDING TODAY INTRODUCTION

Transcription

1 CDR Eric Runnerstrom, USN (Ret) Human Systems Integration and Shipboard Damage Control ABSTRACT As the United States and other maritime nations move towards operating combatant ships with fewer people, human-systems integration (HSI), or humancentered design, is getting increasing attention in new ship designs. Aboard most ships operating today, damage control is a mostly manual, manpower intensive function. Consequently, it is a key area of concern for ship acquisition programs that need to produce ships that will operate with fewer people. Damage control also is critical to the survival of a warship and the safety of the crew. Consequently, it is very important to ship operators. It is no surprise, therefore, that damage control is a key function of concern when designing new ships to operate with fewer people. This paper discusses the state-of-the-art in HSI and damage control aboard ships today as evidenced by the damage control performance of some of today s ships. The paper draws conclusions about the importance of HSI for effective damage control in new ship designs. The successful application of a humancentered design approach in the development of a damage control supervisory control system for the US Navy s Damage Control Automation for Reduced Manning (DC-ARM) program is described. Finally, major challenges to achieving effective HSI in new ship designs are presented. INTRODUCTION Effective damage control (DC) requires a high degree of human-systems integration across several levels under demanding circumstances. The Damage Control Assistant (DCA) depends upon a variety of information sources to maintain situation awareness and conduct high level management of the DC effort. Repair party leaders and scene leaders use more detailed information from a variety of sources to more directly manage the response at lower levels. Repair parties interact directly with components in ship systems to control the damage. The dynamic, stressful nature of the situation pushes human capabilities to their limits. Damage control, therefore, provides the means for a stressing evaluation of the effectiveness of HSI aboard ships today. This paper presents examples of DC performance to gage HSI in ship systems. This is combined with general findings about HSI in combat systems to formulate a general evaluation of HSI aboard ships today. As ships are built to operate with fewer people, effective HSI becomes more important to the very survival of the ship. Recent US Navy research and development to enable effective DC with fewer people provides an example that demonstrates the benefits of designing for effective HSI as well as the difficulties in executing a rigorous human-centered design. General obstacles to improving HSI in future ships are suggested to provide some insights into initiatives that may be undertaken to improve HSI in ship design. THE STATE-OF-THE-ART FOR HSI IN SHIPBUILDING TODAY Examples of ineffective HSI are discussed for ship systems and, more generally, for combat systems. From these examples, general conclusions are drawn regarding HSI in ships today. Ship Systems The firemain aboard a typical surface combatant is a ship system of average complexity. Fire pumps and main loop isolation valves are controlled remotely from Damage Control (DC) Central. In September 1998 the DC-ARM and Integrated Survivability Fleet Evaluation (ISFE) programs conducted joint manned tests that involved damage to the firemain, live fires, and other effects from a representative hit by an anti-ship missile (Williams et al. 2000). Fleet sailors formed the DC teams that were tasked with controlling the damage. It took over 20 minutes for

2 the DC teams to isolate the firemain damage. During that time firemain water was not available to fight fires or cool fire boundaries. Since the breathing air endurance of a DC team member is approximately 20 to 30 minutes, the first team could accomplish little before they had to leave the scene. Since fire can spread in less than 10 minutes, the DC teams could do little to prevent the spread of fire that probably would have occurred. With pressure gage taps at only two locations on the firemain (this Shadwell installation is similar to Navy ships today), DC Central had insufficient information to quickly locate and isolate the firemain damage. Due to poor communications and doctrine not tuned to remote control, DC Central was not aware of the manual actions by the DC teams to isolate the firemain damage, nor were the local DC teams aware of the remote control actions by DC Central. As a result, there was considerable confusion about the status of the firemain, manpower was wasted rigging hoses to fire plugs without water, and precious time was lost. Previous analyses by the Navy s DC Architecture Program, confirmed by Fleet training personnel, concluded that 20 minutes is a representative time for DC teams to isolate fluid system damage resulting from a missile hit. The lack of information to quickly identify and locate a firemain rupture was determined to be a controlling factor preventing more rapid isolation of damage in general. Total Ship Survivability Trials (NAVSEA 1996) demonstrated similar times to isolate firemain damage resulting from a missile hit. The USS Stark (FFG 31) encountered similar problems with recovering from firemain damage after a missile hit (NAVSEA 1988). This consistency demonstrates that the firemain damage recovery results of the DC- ARM/ISFE tests in September 1998 are representative of performance in the Fleet today for ship systems similar to the firemain. It is clear that effective HSI was not achieved in the firemain aboard these ships. The Naval Research Laboratory has been conducting firefighting and DC doctrine tests aboard the Ex-USS Shadwell for many years. These tests have evaluated and improved doctrine with existing ship systems; for example, boundary cooling, low water usage, smoke control, and rapid response for minimum manning. The Shadwell tests also have developed doctrine for new systems; for example, smoke ejection, water mist, and self contained breathing apparatus. This experience has demonstrated that to realize the full performance potential of the integrated man-machine system, doctrine must be developed to complement the technology, whether old or new. Experience from these tests corroborates the firemain experience that ship systems generally have been designed with little effective consideration of the role of the human operators, particularly with respect to the demanding operations that must be conducted to recover from a casualty. Combat Systems The following is from a ship s recent message : As it currently stands, our combat suite is fragile, manpower intensive, difficult to use, and marginally effective.... The HMI interfaces of the combat system... make system operation frustrating at best. Trained operators have difficulty remembering the disproportionately high number of button selections required to perform the simplest tasks. Further, critical functions are nearly impossible to perform in a timely fashion. An example of this is the number of steps required to engage multiple targets by the ship s weapons coordinator. The result is that in multiple threat and quick reaction environments, the weapons coordinator must rely on issuing verbal engagement orders to TAS without an electronic back up. This situation is simply untenable. During a 1999 meeting to define concepts for a new command center, concerns similar to the foregoing were noted by several experienced operators about another combat system aboard Navy surface ships. The chilled water system in a modern combatant ship is vital to the operation of much of the combat systems. Recovery from damage to the chilled water system is just as complex and time consuming as it is for the firemain, perhaps more so. Some vital combat systems equipment will shut down due to loss of cooling long before the chilled water system is restored. Unlike the firemain where firefighting can start as soon as the firemain is restored, restarting air conditioning plants and bringing

3 combat systems equipment back on line may require some additional time after the chilled water system is restored. HSI in Ships Today Considering the examples noted above, one may conclude that the firemain is not an exception, rather it is a representative product of the current state-ofthe-art in HSI in Navy shipbuilding today. Specifically: Ship systems designs have not effectively considered the role of humans in the operation of the systems, particularly under stressing casualty or combat operations. The lack of good HSI in ship systems hampers operations, particularly effective recovery from damage. This reduces the ship s survivability, safety, and ability to maintain mission capability. To realize the reduced manning enabled by technology, doctrine must be developed to complement the new technology. THE SIGNIFICANCE OF HSI FOR FUTURE NAVY SHIPS The basis for existing doctrine and HSI in ships is discussed, followed by some examples of the performance that results from existing practices. This then is extended to the performance one might expect from future ships if existing doctrine and HSI continue to be applied without significant improvements. Manual Basis for Existing Doctrine and HSI The Navy does not have much experience with HSI related to the remote control of distributed systems such as the firemain during damage control. Actual damage experience has involved mostly, perhaps all, manual control of distributed systems, manual firefighting, and other manual DC actions. Information management during actual casualties has been manual (sound powered phone, portable radio communications, and manual DC plots). The Navy s doctrine is built on this history of manual experience. The Navy s limited experience with HSI also is built on such manually operated systems and DC methods. As the Navy moves more toward remote control and automation of ship systems, utilizing the existing, manually based doctrine or the HSI implicit in the old design standards actually results in decreased performance of the overall manmachine system. This was demonstrated during 1998 DC-ARM baseline demonstration with remote control of the firemain with existing design features and doctrine. To provide some insight into the potential effects of inadequate HSI and doctrine for new systems, some examples of current performance are discussed. Existing Performance Perhaps the most expensive repairs to the Stark after being hit by two missiles involved the combat systems equipment. This equipment was not involved in the initial fire; the equipment was damaged by fire spread. When a mine hit the Princeton, intact combat systems equipment shut down due to loss of cooling from the damaged chilled water system. The only personnel injuries during the major fire aboard the Conyngham were from the spread of smoke. Fifty percent of the ships lost in the Falklands were lost due to the inability to control the spread of damage (author s analysis of information in Falkland Islands Study Group 1983). The more specific examples in the previous section describing the state-of-the-art for HSI in ships today provide some understanding of why the overall DC performance summarized above is what happens today. Extending this experience to future ships provides some understanding of the importance of improving HSI. Future Performance Without Improved HSI As shipboard manning is reduced, two things are likely to happen. 1) More distributed systems will be controlled by remote control or automation. 2) Distributed systems will be used more to control damage. For example, sprinkling or water mist may be used more extensively to replace manned hose teams for fire suppression. In such an environment,

4 a small number of people must act effectively and efficiently in concert with the distributed systems. Thus, the actions of the people and the actions of the ship systems would complement one another to control damage. The survival of future ships, therefore, is likely to depend on a more extensive suite of ship systems working in concert with a smaller number of people to control damage. The firemain provides an indication of the performance that will result from utilizing the current state-of-the-art for HSI. Aboard a future ship the problems would be amplified in complexity, confusion, and importance to the survival of the ship. During the time that it would take to recover from damage to ship systems, the crew would be unable to stop the spread of fire. Similarly, some vital combat systems equipment would shut down when the chilled water system is damaged, and the combat system equipment could not be brought back on line until after the chilled water system is restored. The initial efforts of DC personnel generally would be ineffective. Fewer people would be aboard to control the resulting larger extent of damage. If HSI for ship systems is not improved as fewer people must interact with more extensive, automated ship systems, it would be reasonable to expect a larger number of losses in the future. For those ships not lost, the greater extent of damage would result in increased repair costs, more time with the ship out of service, and a larger number of personnel casualties. Given the ineffective HSI noted above in other areas as well as in damage control, the performance problems noted above can be expected throughout many functions aboard ship. To avoid these undesirable consequences, HSI for ship systems will have to improve dramatically beyond that achieved aboard ships today. AN EXAMPLE OF EFFECTIVE HSI The characteristics of the DC-ARM systems are discribed briefly below. This is followed by a discussion of the performance achieved by those systems. The HSI approach used during the development then is summarized. Characteristics of DC-ARM Systems The DC-ARM program developed a supervisory control system for controlling the firemain and for controlling selected types of damage. The firemain control is a distributed control system with integrated device level, system level, and ship level controls. The supervisory control system enables effective situation awareness for the DCA to direct human actions, control ship systems remotely, and integrate ship systems functions with human functions. For example, boundaries are manned only where water mist is not available to contain the fire. Those ship system functions that can be automated reliably, such as actuating the water mist system in response to a fire and isolating ruptured segments of the firemain, are automated. Other ship systems improvements installed aboard the Ex-USS Shadwell as part of the DC-ARM program include: an extensive water mist system for fire suppression (where damage has left the system functional) and fire containment; improved fire detection and fire characterization instrumentation; access closure monitoring; and a smoke ejection system for the DC deck. Performance With Effective HSI The September, 2000 DC-ARM tests demonstrated effective damage control with 60% fewer personnel in an environment replicating the effects of an antiship missile hit aboard a surface combatant (Peatross et al. 2001). (DC manning was reduced from the 110 people aboard a DDG 51 Class ship today to approximately 43 people for the demonstration.) Remote control of the firemain and water mist systems was provided, but automation was not included in the 2000 demonstration. Damage control performance was improved compared to the baseline performance, firemain ruptures were isolated in a timely manner and damage spread was minimized. The September, 2001 DC-ARM tests demonstrated improved damage control effectiveness while maintaining the 60% manning reduction. The refined DC organization addressed concerns about maintaining sustained performance. DC team leaders were well trained. Automation, where it

5 could be employed reliably, was included in the ship systems. And, improvements were made in the supervisory control system to reflect lessons learned during the 2000 demonstration and to enhance the survivability of the system. The Fleet DC teams (working in concert with the ship systems) were able to prevent the spread of damage, and they were able to bring the primary fires under control in less than 30 minutes. This exceeds, substantially, the performance demonstrated in any test aboard the Ex- USS Shadwell in over a decade of DC testing with Fleet personnel. During related tests aboard the Ex-USS Shadwell, the HSI of the firemain supervisory control was evaluated by conducting rupture isolation tests with only remote manual control. An operator with working knowledge of the firemain, no experience with the supervisory control system, and less than five minutes of training on the system was able to identify and isolate ruptures in less than two minutes. Achieving Effective HSI Effective HSI is an essential feature in achieving the performance described above. This performance was achieved by rigorous attention to HSI from the beginning of the supervisory control system development. Human factors guidance from a variety of industries (for example, aviation and nuclear power) was adapted to the specific application of shipboard DC. During development, the system displays were periodically evaluated by human factors experts, by independent engineers knowledgeable of ship systems and DC, and by Fleet operators. Functional analysis was used to define the functions that needed to be performed, to allocate the functions to systems and to personnel, and to define automated functions (Runnerstrom et al, 1999). The functional analysis provided the basis for information to display to support human decisions and actions. The functional analysis also provided the first order algorithms for developing computer code for decision aids and for automation. The functional analysis was developed over about a year before the associated computer code was developed. The functional analysis development included periodic, independent expert evaluation. By conventional standards, this was an extraordinary amount of time and effort to devote to the analytical basis for code development. The results, however, demonstrate the value of such an extensive analytical basis. The associated computer code development was completed in approximately half the time and effort that would have been needed otherwise. The code performed as expected without any major deficiencies; only minor bugs needed correction. Extensive changes in the architecture of the code (implemented in 2001 to enable widely distributed processing to enhance system survivability and enable automation) were accomplished without detracting from the performance of the system. Finally, the system enabled the high overall damage control performance described above. On the other hand, conducting the functional analysis required a formidable effort. Functional analysis is fundamentally different than the conventional approach to designing systems. The design team had difficulty adjusting to this new approach, and it took several false starts and a very intense effort to get a useable analysis started. Expert review of the analysis, particularly during the later stages of the development, was difficult due to the complexity of the analysis. Experts who were able to conduct a meaningful review had to devote considerable time and concentration to their review. During the early stages of the development, the temptation to start writing code had to be avoided until the analysis was completed. This experience, nevertheless, clearly demonstrates the value of rigorous attention to HSI from the beginning of system development. DC manning was reduced by 60% while DC performance improved dramatically. This improved performance leads directly to reducing damage and injuries resulting from casualties, improving mission capability during a casualty event, and reducing ship losses due to casualties. Overall development costs were reduced because code development proceeded quickly without the need for major rework. The system performed as required with only minor debugging. OBSTACLES TO IMPROVING HSI IN FUTURE NAVY SHIPS

6 The following factors are likely to hamper rapid implementation of effective HSI in shipbuilding: Ship and ship systems engineers have had little or no formal education in HSI. Ship and ship systems engineers have had little experience with the rigorous application of HSI methods in ship design. There is little information available in the literature that describes the effective application of HSI to the design of ships and ship systems. Shipbuilding is a conservative industry because the costs of design mistakes can be very high. HSI is not a mature technical discipline, particularly compared to the HSI demands for successful damage control. Programs typically are reluctant to increase front end design costs. The lack of formal education opportunities in HSI for ship designers is an assumption that is not discussed further. The lack of experience with good HSI practices in ship design is demonstrated by the performance discussed above. A literature search for the DC-ARM development identified few published books or technical articles about actual applications of HSI methods in ship design. This is critical because, as described above, rigorously using functional analysis as the basis for a design is not a straightforward extension of conventional design techniques. Differences between the aerospace and nuclear industries and shipbuilding have a significant influence on the application of new HSI methods to ship design. Unlike nuclear plant control rooms or aerospace vehicles, the Navy does not build prototype ships to evaluate HSI and refine a design. The first ship built will be an operating combat unit. In addition, it usually is expensive, and often impractical to correct design errors after a ship is built. The Fleet often must live for 30 years or more with the problems caused by original design errors. Consequently, the risks of innovation are high and ship design tends to be conservative. (Mock ups of critical spaces, and perhaps critical systems, are used to improve a design, but this only addresses part of the problem.) On the other hand, as noted above, the failure to consider HSI is almost sure to lead to poor performance aboard a more automated, reduced manned ship of the future. HSI has been evolving as a defined technical discipline in the aerospace industry in the US for about 50 years (Bost et al. 1999). Since the Three Mile Island nuclear plant accident in 1979, HSI has been given considerable attention in the design of control rooms in nuclear power plants. A more extensive list of the references reviewed regarding the state-of-the-art is in Runnerstrom et al., The author s coarse evaluation of the general stateof-the-art is: Some guidelines have been developed for the human-computer interface. These guidelines are specific in their content (i.e. they address specific features such as font size), but generic in their application (i.e. they are not tailored to a specific type of application in a particularly industry, such as controls for hull, mechanical and electrical systems aboard ships). Methods for functional analysis have been defined. But, their application appears to have been limited to mostly studies and the analysis of human factors concerns in systems that are in service (Ainsworth and Kirwin 1992), rather than in the actual design of new systems. In other words, there is little experience with the actual application of functional analysis methods in the design of complex systems. The Dutch Navy has used HSI to achieve reductions in frigate manning. Credible models and standards have been developed for some of the physical aspects of human performance, for example, vision, hearing, muscle behavior/strength and physical size. These have been used in the design of some systems. Credible, comprehensive models for human cognitive performance do not exist. More fundamental research is needed in this area. Cognitive performance under stress is very important to DC performance. Methods and guidelines for HSI design for specific applications (such as a firemain, an electrical distribution system, or ship watertight compartmentation) are practically nonexistent.

7 In the aerospace industry, where HSI has a 50 year history of development and application, good HSI practices still are not applied consistently. For example, Woods (1994) and others cite several failures in HSI. These examples are from aviation, aerospace and military systems in which the designers probably tried their best to apply state-ofthe-art HSI principles. Research is ongoing in HSI, probably in all of the aspects noted above. Navy research by human factors experts is addressing cognitive modeling and the development of tools that can be used to address HSI in ship design. HSI development today appears to focus, more often than not, on the human operator in a hierarchical system that is more or less automated with one or more human supervisors controlling the system through a computer interface. The focus of the HSI development is on the human-computer interface. In addition to such a structure, however, DC requires that people interact physically with the individual components in systems throughout the ship. This type of HSI for DC is different, and more complex, than the strictly top level human-computer interface being addressed by most of the current work in HSI. Consequently, HSI for DC probably is beyond most of the current work to extend the state-of-the-art in HSI. Given the state-of-the-art, it is clear that achieving good HSI cannot be taken for granted. Merely establishing a requirement for HSI will not produce effective HSI because the infrastructure does not exist to implement the requirement. In the longer term, research, development, education, tools for designers, and more will be needed before requirements for HSI can be implemented routinely to produce a final product with good HSI. In the near term, achieving good HSI will take a dedicated, sincere and persistent effort with substantially more up front engineering than what has been applied to past designs. Perhaps the most formidable obstacle to achieving the performance that results from good HSI is the typical reluctance of program managers to devote the time and resources to the necessary up front design and analysis effort. The extensive analysis requires the discipline to continue a project for an extended period without the kind of tangible (albeit lacking) products typical of conventional design and acquisition approaches. Furthermore, the results of such a disciplined approach usually are avoided costs (because it was done right the first time) and improved performance. Consequently, it is difficult to present a convincing case for the overall cost reduction that results from the considerable increases in the front end costs of the program. Experience in the DC-ARM program indicates that HSI design methods will be valuable tools to improve systems integration in general and to enhance the design of control systems in addition to providing effective HSI. These methods show promise to improve the overall performance of the man-machine system (i.e. the ship), enable significant reductions in manning, and reduce overall development cost. CONCLUSION Experience with DC aboard ships today demonstrates that effective HSI has not been achieved. Ineffective HSI has a direct impact on DC performance and is a significant factor in damage spread, which reduces the mission capability of the ship, increases repair costs, and affects ship losses. As shipboard manning is reduced aboard future ships, substantial improvement in HSI will be needed to avoid deteriorating DC performance and the resulting reductions in mission capability and increases in repair costs and ship losses. Experience with the DC-ARM program demonstrates that HSI can be improved and that the resulting benefits in reduced development cost and improved performance can be substantial. Effectively implementing human-centered design techniques, on the other hand, is not easy. Given the state-of-the-art today, a concerted effort will be necessary to utilize effective human-centered design approaches for ships and ship systems. Both near term and longer term initiatives are needed. Near term initiatives can improve HSI in near term designs and help start incorporating HSI into ship design culture. Longer term initiatives also

8 are needed so that with time, achieving the benefits of effective HSI will become routine. Near term initiatives can be productive on a scale smaller than an entire ship design. Human-centered design techniques can be demonstrated in research and development programs and in ship alteration designs. Such initiatives would help introduce human-centered design techniques to ship designers with minimum cost. Longer term initiatives involve education and developing design methods and tools. Education initiatives could start with fairly simple projects such as an HSI course for the Navy s Professional Summer courses at MIT. Longer term initiatives might include formal courses in the regular curriculum at MIT and the Navy Post Graduate School. Design methods and tools are needed to improve the efficiency of human-centered design. These tools must be specific to ship design. For DC, dynamic analysis tools also are needed to assess the performance of the integrated human-machine system and understand how it can be optimized. Finally, and perhaps most important, HSI advocates must build the case for Navy research and development managers, modernization program managers and ship acquisition managers to allocate resources and time to these initiatives. Long term persistence will be required to define projects, get them approved, ensure their success, and demonstrate the benefits that result. REFERENCES Ainsworth, L. K., and Kirwin, B. (Ed), A Guide to Task Analysis, Taylor & Francis, Washington, D. C., 1992, ISBN Bost, J.R., et al., Innovative Human Systems Integration in the DD 21 System Design and Manning, Acquisition Research Symposium, Falkland Islands Study Group, Lessons Learned of the Falklands, Summary Report, Office of Program Appraisal, Report No. AD/A , Jul NAVSEA, Damage Analysis Team Report on USS STARK (FFG 31), Damage Assessment and Analysis, Naval Sea Systems Command, Feb NAVSEA, DDG 51 Live Fire Test and Evaluation (LFT&E) Program, Total Ship Survivability Trial (TSST) Final Report, 29 January Peatross, M. J., et al., Results of the FY 2000 DC- ARM Demonstration, Naval Research Laboratory report 6180/0029A:FWW, Jan. 31, Runnerstrom, E., et al., DC-ARM Supervisory Control System Development: Phase I, Naval Research Laboratory report NRL/MR/ , Jun. 26, Williams, F., et al., Results of 1998 DC-ARM/ISFE Demonstration Tests, Naval Research Laboratory report NRL/FR/ , Apr. 25, Woods, D. D., et al, Behind Human Error: Cognitive Systems, Computers, and Hindsight, Crew Systems Ergonomics Information Analysis Center, Wright-Patterson AF Base, Dec ACKNOWLEDGMENTS The author has had the good fortune to participate in some of the US Navy s DC research and development programs during the last decade. These include the Naval Research Laboratory s (NRL) annual ISFE tests aboard the Ex-USS Shadwell, NAVSEA s associated doctrine development, and the Office of Naval Research/NRL DC-ARM program. Working with the manning/human-systems integration group in the DD 21 Program Office has provided the author with added experience in HSI. Participation in these and similar US Navy projects have provided the knowledge, experience, and insights reflected in this paper. The author would like to thank Dr. Fred Williams (NRL 6180), Dave Satterfield (in NAVSEA 05L), and Bob Bost (in PMS 500) for pursuing initiatives such as these and providing the opportunity to contribute to such worthwhile improvements.

9 Eric Runnerstrom is an executive engineer at MPR Associates. For the last eight years, Mr. Runnerstrom has performed research and development engineering for several of the US Navy s projects to improve firefighting doctrine and to develop and demonstrate technology for damage control with reduced manning. Mr. Runnerstrom also supported the Program Executive Office for the DD 21 acquisition in the areas of HSI and damage control. Prior to working for MPR Associates, Mr. Runnerstrom was an engineering duty officer in the US Navy where some of his work involved ship systems survivability. He worked on the survivability features of the DDG 51 design, and he developed the Navy s deactivation diagram-damage tolerance methodology for assessing the survivability of distributed ship systems. Mr. Runnerstrom holds degrees in Naval Architecture, Marine Engineering, and Ocean Engineering from Webb Institute of Naval Architecture and from Massachusetts Institute of Technology.